&nbsp;
At Optum, we value the distinctive talents and perspectives each employee brings to our workplace. We foster an inclusive work environment through various initiatives like our Employee Resource Groups, which are connected internal communities that focus on sharing our diverse experiences and backgrounds, creating a greater sense of belonging.
<a id="m_3228872436145793904m_-3991317240390317092OWA89bc3dac-771b-a754-7ba5-5bcced69cc5f" title="https://www.optum.in/about/diversity-equity-inclusion.html" href="https://www.optum.in/about/diversity-equity-inclusion.html" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.unitedhealthgroup.com/careers/in/culture/diversity-equity-inclusion.html&amp;source=gmail&amp;ust=1762842463320000&amp;usg=AOvVaw2nibKunvLIEeyJkda5QUpG">Learn more</a>

Optum

As a senior member of the Security Incident Response Team, you will lead the detection, triage, containment, eradication, and recovery of cybersecurity incidents across on prem and cloud environments. You will act as a technical authority during major incidents, drive continuous improvement through post-incident reviews, and partner with engineering, risk, and compliance teams to strengthen the organization’s overall security posture.Primary Responsibilities:• Incident Detection, Response & Recoveryo Own and manage the full incident response lifecycle: identification, triage, containment, eradication, recovery, and closureo Analyze and correlate alerts from SIEM and security telemetry (e.g., Splunk, EDR, email, proxy, DLP, cloud-native logs)o Lead response for high-severity incidents and security breaches, including ransomware, data exfiltration, insider threats, and cloud compromise• Incident Command & Collaborationo Act as a technical incident lead or deputy incident commander during major incidents and war rooms, ensuring clear communication and timely decision-makingo Collaborate with IT, Cloud, Engineering, Legal, Risk, Privacy, and Business teams to ensure coordinated containment and remediationo Engage with vendors, MSSPs, and external partners during escalated incidents when required• Cloud & Modern Infrastructure Securityo Investigate and respond to incidents across cloud platforms (Azure, AWS, GCP), including IAM abuse, misconfigurations, exposed services, and compromised workloadso Partner with engineering teams to improve cloud detection, logging, and preventive controls based on incident learnings• Threat Analysis, Forensics & Lessons Learnedo Perform root cause analysis and forensic investigations to determine attack vectors and blast radiuso Conduct post-incident reviews and lessons-learned sessions, driving measurable improvements in tooling, playbooks, and response timeso Maintain high-quality incident documentation and executive-ready reporting• Process, Automation & Readinesso Develop, refine, and maintain incident response playbooks, runbooks, and SOPs aligned with industry best practiceso Contribute to tabletop exercises, purple-team activities, and simulations to test readiness and identify gapso Identify opportunities for automation and orchestration (SOAR, scripting) to improve detection and response efficiency• Risk, Compliance & Governanceo Support ISO 27001, HITRUST, and regulatory audits with evidence, incident metrics, and control validation• Demonstrate solid understanding of risk acceptance, risk exceptions, and vulnerability management in the context of incident response• Comply with the terms and conditions of the employment contract, company policies and procedures, and any and all directives (such as, but not limited to, transfer and/or re-assignment to different work locations, change in teams and/or work shifts, policies in regards to flexibility of work benefits and/or work environment, alternative work arrangements, and other decisions that may arise due to the changing business environment). The Company may adopt, vary or rescind these policies and directives in its absolute discretion and without any limitation (implied or otherwise) on its ability to do soRequired Qualifications:• Solid5+ years of hands-on experience in Security Operations / Incident Response / SOC roles• SolidProven experience handling major security incidents in enterprise environments• SolidSolid expertise in SIEM, log analysis, and security monitoring• SolidSolid understanding of attack techniques, malware, OWASP Top 10, MITRE ATT&CK, and common threat vectors• Working knowledge of ITIL processes (Incident, Problem, Change) as applied to security incidentsPreferred Qualifications:• SolidCISSP, GCED/GCIA/GCIH, Security+, CEH• SolidCloud certifications: AZ 900 / AWS Security / GCP Security• SolidExperience with cloud-native security and large-scale distributed environments• SolidExposure to SOAR platforms, scripting (Python/PowerShell), or automation in IR workflows• SolidExperience operating in 24×7 global incident response teams• Ability to translate technical findings into business and executive-level impactCompetencies for High Performers• SolidCalm and decisive under pressure• SolidSolid ownership and accountability mindset• SolidExcellent written and verbal communication• SolidProcess-driven with a continuous improvement approach• Collaborative, mentor-oriented team player

Job Details

Skills Required

More Details

Apply